REMARKS 



Reconsideration and allowance of the claims are requested in view of the above the 
previous amendments and following remarks. Claim 4 has been canceled without prejudice or 
disclaimer. Claims 1, 7, 13, 14, 18-20, 23, 24, 31 and 36 have been amended. Claims 1-3, and 5- 
6 are pending in the present application, with claims 1,13 and 24 being independent. 

Double Patenting 

The Office Action has provisionally rejected claims 1-36 on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims in copending US. Patent 
Applications No. 10/690,422, 10/849,090, and 10/994,010. Applicants intend to file a terminal 
disclaimer when the double patenting rejection becomes final and when the claims of the present 
application are allowed. 

Rejections Under 35 U.S.C. S103 

The Office Action rejects claims 1, 3-8, 13, 14, 16-19, 24, 25, 25, 32-36 under 35 U.S.C. 
§ 103(a) as being unpatentable over Bandini et al. (U.S. Patent 7,1 17,358) in view of Mastrianni 
(U.S. Publication No. 2002001 16641). In addition, the Office Action rejects claims 2, 9-12, 15, 
20-23, 26-31 under 35 U.S.C. § 103(a) as being unpatentable over Bandini et al. in view of 
Mastrianni and further in view of Lewis et al. (U.S. Publication No. 20030109248). Applicants 
respectfully request reconsideration of the rejection for at least the following reasons. 

Claims 1 

As amended, Claim 1 recites: 

a plurality of servers that receive e-mail messages for a plurality of different remotely 
located clients, the plurality of servers being part of a distributed network; 

a plurality of packet sniffers, wherein each of the packet sniffers in the plurality of packet 
sniffers corresponds to and resides in a different server in the plurality of servers, wherein each 
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packet sniffer in the plurality of packet sniffers is configured to extract originating IP addresses 
associated with e-mail messages that are communicated to the clients over the distributed 
network; 

a central monitor that communicates over the distributed network with the plurality of 
packet sniffers and that monitors data regarding the originating IP addresses, wherein the central 
monitor is configured to determine whether traffic from an originating IP address has exceeded a 
threshold value, the central monitor being further configured to generate a response to detect 
spam e-mail messages if the threshold value has been exceeded; and 

a server in which the central monitor resides, wherein the server is located separate from 
each of the packet sniffers in the plurality of packet sniffers in the distributed network. 



The Office Action cites Bandini's e-mail relay (46) as disclosing a packet sniffer, and 
Bandinni's email server (40) as disclosing one or more of the plurality of email servers as 
claimed. However, the Office Action fails to show how Bandini teaches a central monitor as 
claimed in the present application. 

Furthermore, the semantic engine disclosed in Mastrianni does not cure this deficiency. 
The Office Action relies on the semantic engine of Mastrianni. However, the semantic engine 
(304) of Mastrianni is located the client computer, not at the email server. This is apparent in the 
diagram of Figure 3, where the semantic engine (304) is part of the email filter (300), which 
connects via a network connection (302) to a mail server. In addition, the flow chart of Figure 4 
shows that at step (402) an email is received from the server, and at step (404) the email is 
filtered through the semantic engine. See, Mastrianni, Figures 3 and 4. Therefore, the semantic 
engine (304) of Mastrianni does not anticipate a central monitor in a separate server that 
communicates with a plurality of packet sniffers. 

Thus, the semantic engine (304) as disclosed by Mastrianni does not anticipate or provide 
the functionality of a "central monitor that communicates with the plurality of packet sniffers and 
that central monitors data regarding the originating IP addresses, wherein the central monitor is 
configured to determine whether traffic from an originating IP address has exceeded a threshold 
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value, the central monitor being further configured to generate a response to detect spam e-mail 
messages if the threshold value has been exceeded." 

Furthermore, the Office Action indicates that Mastrianni discloses wherein: [sic] 

b) the central monitors data regarding the originating IP addresses, determines whether 
traffic from an originating IP address has exceeded a threshold value, (see Mastrianni paragraph 
[0007], lines 5-7; paragraph [0020], lines 12-17; paragraph [0038], lines 1-2: originating IP 
addresses used for email processing)." 

As taught by Mastrianni, the semantic engine assigns weights to objectionable words. 
The threshold value in Mastrianni refers to values of weights to words in email content, and not 
"whether traffic from an originating IP address has exceeded a threshold value." The threshold 
value in the present application refers to email traffic. Therefore, Mastrianni does not teach "a 
central monitor that communicates with the plurality of packet sniffers and that monitors data 
regarding the originating IP addresses, wherein the central monitor is configured to determine 
whether traffic from an originating IP address has exceeded a threshold value, the central 
monitor being further configured to generate a response to detect spam e-mail messages if the 
threshold value has been exceeded." Accordingly, Bandini et al. and Mastrianni, alone or in 
combination, does not disclose a central monitor as disclosed in the present application. 

Claims 13 and 24 

Claims 13 and 24 further disclose a central monitor that "configured to generate a 

response to detect spam e-mail messages if the threshold value has been exceeded" and Claim 24 

discloses "generating, at a central monitor, a response for use in detecting spam e-mail messages 

if the threshold value has been exceeded." Bandini et al. and Mastrianni do not disclose the 

generation of a response at the central monitor as disclosed in the present application. Bandini 
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teaches an e-mail relay 46 which is "adapted to [ . . . ] generate a special message to the intended 
recipient indicating that the e-mail message has been diverted." See, Bandini, Column 3, Lines 
60-65. However, as disclosed in Bandini, it is the e-mail relay 46 (cited to anticipate packet 
sniffers) that generates a special message, not a central monitor. Thus, Bandini et al. and 
Mastrianni fail to teach a response generated at the central monitor. 



Therefore, since Bandini et al. and Mastrianni, alone or in combination, fail to disclose or 
suggest all of the elements of claims 1, 13 and 24, these claims are allowable. Furthermore, 
claims 2-12 depend from claim 1. Claims 14-23 depend from claim 13. Claims 25-36 depend 
from claim 24. As discussed above, claims 1, 13 and 24, are allowable over Bandini et al. and 
Mastrianni. For at least this reason, and the additional features recited therein, claims 2-12, 14- 
23 and 25-36 are also allowable. For at least the reasons above, reconsideration and withdrawal 
of the rejection of claims 1-36 under 35 U.S.C. § 103(a) is respectfully requested. 

Conclusion 

Accordingly, in view of the above amendment and remarks it is submitted that the claims 
are patentably distinct over the prior art cited and that all the rejections to the claims have been 
overcome. Based on the foregoing, applicants respectfully request that the pending claims be 
allowed, and that a timely Notice of Allowance be issued in this case. If the Examiner believes, 
after this amendment, that the application is not in condition for allowance, the Examiner is 
requested to call the applicants' attorney at the telephone number listed below. 

If this response is not considered timely filed and if a request for an extension of time is 
otherwise absent, applicants hereby request any necessary extension of time. If there is a fee 
occasioned by this response, including an extension fee that is not covered by an enclosed check 
please charge any deficiency to Deposit Account No. 50-0463. 
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Respectfully submitted, 
Microsoft Corporation 



Date: March 21. 2008 By: /Pablo E. Tapia/ 

Pablo E. Tapia, Reg. No.: 52,275 
Attorney for Applicants 
Direct telephone: (425) 707-0058 
Microsoft Corporation 
One Microsoft Way 
Redmond WA 98052-6399 



CERTIFICATE OF MAILING OR TRANSMISSION 
(Under 37 CFR § 1.8(a)) or ELECTRONIC FILING 

I hereby certify that this correspondence is being electronically deposited with the USPTO via 
EFS-Web on the date shown below: 

March 21. 2008 /Noemi Tovar/ 

Date Noemi Tovar 



Type of Response: Amendment 
Application Number: 10/728,023 
Attorney Docket Number: 3 1 5549.0 1 
Filing Date: December 3, 2003 

12/12 



